Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth management component that could lead to system instability or crashes. The issue occurs when certain Bluetooth commands are processed after they have already been removed or freed from memory. This could potentially be exploited by a local attacker to cause a denial-of-service (system crash) or execute unauthorized actions on the affected device.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel Bluetooth Management (MGMT) interface. The root cause is a race condition where a 'struct mgmt_pending' object is freed (e.g., during a power-off event or timeout) while a workqueue task is still processing it, specifically within functions like 'mgmt_add_adv_patterns_monitor_sync'. An attacker with local access could trigger these concurrent operations to cause a kernel panic or potentially achieve local privilege escalation. The fix introduces 'mgmt_pending_valid' to verify the object's existence in the pending list while holding the 'mgmt_pending_lock' to prevent Time-of-Check Time-of-Use (TOCTOU) issues. Patches have been released in various stable kernel branches.
Affected products
- Linux Linux Kernel 6.16.4
Timeline
- 2025-08-25: disclosed: Initial patch author date
- 2025-10-15: advisory: NVD publication date